-
Notifications
You must be signed in to change notification settings - Fork 12
/
oc2ls-v2.0-types.jadn
147 lines (114 loc) · 8.87 KB
/
oc2ls-v2.0-types.jadn
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
{
"info": {
"package": "http://docs.oasis-open.org/openc2/ns/types/v2.0",
"version": "0-wd01",
"title": "OpenC2 Language Common Types",
"description": "Common Types from the OpenC2 Language Specification version 1.1. These definitions are referenced by or copied into Profiles",
"exports": ["Artifact", "Command-ID", "Date-Time", "Device", "Domain-Name", "Duration", "Email-Addr", "Feature", "Features", "File", "IDN-Domain-Name", "IDN-Email-Addr", "IPv4-Net", "IPv4-Connection", "IPv6-Net", "IPv6-Connection", "IRI", "MAC-Addr", "Nsid", "Process", "Properties", "Response-Type", "Status-Code", "URI", "SemVer"]
},
"types": [
["Artifact", "Record", ["{1"], "", [
[1, "mime_type", "String", ["[0"], "Permitted values specified in the IANA Media Types registry, [[RFC6838]](#rfc6838)"],
[2, "payload", "Payload", ["[0"], "Choice of literal content or URL"],
[3, "hashes", "Hashes", ["[0"], "Hashes of the payload content"]
]],
["Device", "Map", ["{1"], "", [
[1, "hostname", "Hostname", ["[0"], "A hostname that can be used to connect to this device over a network"],
[2, "idn_hostname", "IDN-Hostname", ["[0"], "An internationalized hostname that can be used to connect to this device over a network"],
[3, "device_id", "String", ["[0"], "An identifier that refers to this device within an inventory or management system"]
]],
["Domain-Name", "String", ["/hostname"], "[[RFC1034]](#rfc1034), Section 3.5", []],
["Email-Addr", "String", ["/email"], "Email address, [[RFC5322]](#rfc5322), Section 3.4.1", []],
["Features", "ArrayOf", ["*Feature", "{0", "q"], "An array of names used to query a Consumer for its supported capabilities.", []],
["File", "Map", ["{1"], "", [
[1, "name", "String", ["[0"], "The name of the file as defined in the file system"],
[2, "path", "String", ["[0"], "The absolute path to the location of the file in the file system"],
[3, "hashes", "Hashes", ["[0"], "One or more cryptographic hash codes of the file contents"]
]],
["IDN-Domain-Name", "String", ["/idn-hostname"], "Internationalized Domain Name, [[RFC5890]](#rfc5890), Section 2.3.2.3", []],
["IDN-Email-Addr", "String", ["/idn-email"], "Internationalized email address, [[RFC6531]](#rfc6531)", []],
["IPv4-Net", "Array", ["/ipv4-net"], "IPv4 address and prefix length", [
[1, "ipv4_addr", "IPv4-Addr", [], "IPv4 address as defined in [[RFC0791]](#rfc0791)"],
[2, "prefix_length", "Integer", ["[0"], "CIDR prefix-length. If omitted, refers to a single host address."]
]],
["IPv4-Connection", "Record", ["{1"], "5-tuple that specifies a tcp/ip connection", [
[1, "src_addr", "IPv4-Net", ["[0"], "IPv4 source address range"],
[2, "src_port", "Port", ["[0"], "Source service per [[RFC6335]](#rfc6335)"],
[3, "dst_addr", "IPv4-Net", ["[0"], "IPv4 destination address range"],
[4, "dst_port", "Port", ["[0"], "Destination service per [[RFC6335]](#rfc6335)"],
[5, "protocol", "L4-Protocol", ["[0"], "Layer 4 protocol (e.g., TCP) - see [Section 3.4.2.10](#34210-l4-protocol)"]
]],
["IPv6-Net", "Array", ["/ipv6-net"], "IPv6 address and prefix length", [
[1, "ipv6_addr", "IPv6-Addr", [], "IPv6 address as defined in [[RFC8200]](#rfc8200)"],
[2, "prefix_length", "Integer", ["[0"], "prefix length. If omitted, refers to a single host address"]
]],
["IPv6-Connection", "Record", ["{1"], "5-tuple that specifies a tcp/ip connection", [
[1, "src_addr", "IPv6-Net", ["[0"], "IPv6 source address range"],
[2, "src_port", "Port", ["[0"], "Source service per [[RFC6335]](#rfc6335)"],
[3, "dst_addr", "IPv6-Net", ["[0"], "IPv6 destination address range"],
[4, "dst_port", "Port", ["[0"], "Destination service per [[RFC6335]](#rfc6335)"],
[5, "protocol", "L4-Protocol", ["[0"], "Layer 4 protocol (e.g., TCP) - [Section 3.4.2.10](#34210-l4-protocol)"]
]],
["IRI", "String", ["/iri"], "Internationalized Resource Identifier, [[RFC3987]](#rfc3987).", []],
["MAC-Addr", "Binary", ["/eui"], "Media Access Control / Extended Unique Identifier address - EUI-48 or EUI-64 as defined in [EUI](#eui)", []],
["Process", "Map", ["{1"], "", [
[1, "pid", "Integer", ["[0", "{0"], "Process ID of the process"],
[2, "name", "String", ["[0"], "Name of the process"],
[3, "cwd", "String", ["[0"], "Current working directory of the process"],
[4, "executable", "File", ["[0"], "Executable that was executed to start the process"],
[5, "parent", "Process", ["[0"], "Process that spawned this one"],
[6, "command_line", "String", ["[0"], "The full command line invocation used to start this process, including all arguments"]
]],
["Properties", "ArrayOf", ["*String", "{1", "q"], "A list of names that uniquely identify properties supported by a Consumer.", []],
["URI", "String", ["/uri"], "Uniform Resource Identifier, [[RFC3986]](#rfc3986).", []],
["Date-Time", "Integer", ["{0"], "Date and Time", []],
["Duration", "Integer", ["{0"], "A length of time", []],
["Feature", "Enumerated", [], "Specifies the results to be returned from a query features Command", [
[1, "versions", "List of OpenC2 Language versions supported by this Consumer"],
[2, "profiles", "List of profiles supported by this Consumer"],
[3, "pairs", "List of supported Actions and applicable Targets"],
[4, "rate_limit", "Maximum number of Commands per minute supported by design or policy"]
]],
["Hashes", "Map", ["{1"], "Cryptographic hash values", [
[1, "md5", "Binary", ["/x", "{16", "}16", "[0"], "MD5 hash as defined in [[RFC1321]](#rfc1321)"],
[2, "sha1", "Binary", ["/x", "{20", "}20", "[0"], "SHA1 hash as defined in [[RFC6234]](#rfc6234)"],
[3, "sha256", "Binary", ["/x", "{32", "}32", "[0"], "SHA256 hash as defined in [[RFC6234]](#rfc6234)"]
]],
["Hostname", "String", ["/hostname"], "Internet host name as specified in [[RFC1123]](#rfc1123)", []],
["IDN-Hostname", "String", ["/idn-hostname"], "Internationalized Internet host name as specified in [[RFC5890]](#rfc5890), Section 2.3.2.3.", []],
["IPv4-Addr", "Binary", ["/ipv4-addr"], "32 bit IPv4 address as defined in [[RFC0791]](#rfc0791)", []],
["IPv6-Addr", "Binary", ["/ipv6-addr"], "128 bit IPv6 address as defined in [[RFC8200]](#rfc8200)", []],
["L4-Protocol", "Enumerated", [], "Value of the protocol (IPv4) or next header (IPv6) field in an IP packet. Any IANA value, [[RFC5237]](#rfc5237)", [
[1, "icmp", "Internet Control Message Protocol - [[RFC0792]](#rfc0792)"],
[6, "tcp", "Transmission Control Protocol - [[RFC0793]](#rfc0793)"],
[17, "udp", "User Datagram Protocol - [[RFC0768]](#rfc0768)"],
[132, "sctp", "Stream Control Transmission Protocol - [[RFC4960]](#rfc4960)"]
]],
["Nsid", "String", ["{1", "}16"], "A short identifier that refers to a namespace.", []],
["Payload", "Choice", [], "", [
[1, "bin", "Binary", [], "Specifies the data contained in the artifact"],
[2, "url", "URI", [], "MUST be a valid URL that resolves to the un-encoded content"]
]],
["Port", "Integer", ["{0", "}65535"], "Transport Protocol Port Number, [[RFC6335]](#rfc6335)", []],
["Response-Type", "Enumerated", [], "", [
[0, "none", "No response"],
[1, "ack", "Respond when Command received"],
[2, "status", "Respond with progress toward Command completion"],
[3, "complete", "Respond when all aspects of Command completed"]
]],
["Status-Code", "Enumerated", ["="], "", [
[102, "Processing", "an interim Response used to inform the Producer that the Consumer has accepted the Command but has not yet completed it"],
[200, "OK", "the Command has succeeded"],
[201, "Created", "the Command has succeeded and a new resource has been created as a result of it"],
[400, "Bad Request", "the Consumer cannot process the Command due to something that is perceived to be a Producer error (e.g., malformed Command syntax)"],
[401, "Unauthorized", "the Command Message lacks valid authentication credentials for the target resource or authorization has been refused for the submitted credentials"],
[403, "Forbidden", "the Consumer understood the Command but refuses to authorize it"],
[404, "Not Found", "the Consumer has not found anything matching the Command"],
[500, "Internal Error", "the Consumer encountered an unexpected condition that prevented it from performing the Command"],
[501, "Not Implemented", "the Consumer does not support the functionality required to perform the Command"],
[503, "Service Unavailable", "the Consumer is currently unable to perform the Command due to a temporary overloading or maintenance of the Consumer"]
]],
["Command-ID", "String", ["%^\\S{0,36}$"], "Command Identifier", []],
["SemVer", "String", ["%^(\\d{1,4})(\\.(\\d{1,6})){0,2}$"], "Major.Minor.Patch version number", []]
]
}